SAP NetWeaver Archives

New SAP NetWeaver Bug Lets Attackers Take Over Servers Without Login

15Oct

By RBNo Comments

News

New SAP NetWeaver Bug Lets Attackers Take Over Servers Without Login

Additional hardening for a maximum-severity problem in SAP NetWeaver AS Java that could lead to arbitrary command execution is one of 13 new security concerns that SAP has released security solutions for. The vulnerability has a CVSS score of 10.0 and is tagged as CVE-2025-42944. Some have referred to it as an instance of insecure deserialization. According to a description of the flag on CVE.org, an unauthenticated attacker might use the RMI-P4 module to exploit the system by sending a malicious payload to an open port because of a deserialization vulnerability in SAP NetWeaver. The confidentiality, integrity, and availability of the program may be seriously jeopardized if such untrusted Java objects were deserialized because this could result in unauthorized OS command executio...

BianLian and RansomExx Exploit SAP NetWeaver Flaw to Deploy PipeMagic Trojan

A recently revealed security vulnerability in SAP NetWeaver, tagged as CVE-2025-31324, is reportedly being used by at least two distinct cybercrime organizations, BianLian and RansomExx. This suggests that several threat actors are abusing the vulnerability. In a new report released today, cybersecurity company ReliaQuest said it has found evidence of involvement from the RansomExx ransomware family, which Microsoft tracks under the name Storm-2460, and the BianLian data extortion crew. Based on infrastructure ties to IP addresses previously identified as belonging to the e-crime organization, BianLian is evaluated as having been involved in at least one event. According to the company, we found a server at 184[.]174[.]96[.]74 that was providing reverse proxy services that were s...

New Critical SAP NetWeaver Flaw Exploited to Drop Web Shell Brute Ratel Framework

To enable unauthorized file uploads and code execution, threat actors are probably taking advantage of a recently discovered flaw in SAP NetWeaver that allows them to upload JSP web shells. According to a research released this week by ReliaQuest, the exploitation is probably connected to either an undisclosed remote file inclusion (RFI) problem or a previously known vulnerability such as CVE-2017-9844. According to the cybersecurity expert, the likelihood of a zero-day attack arises since a number of the affected computers were already using the most recent fixes. The "/developmentserver/metadatauploader" endpoint in the NetWeaver environment is thought to be the source of the vulnerability, which allows unidentified threat actors to upload malicious JSP-based web shells in the ...